When a Red Flag Pops on Maryam’s Screen, Karachi’s Bank Turns on Its AI Shield
By Muzammil
The air in the Al Falah branch on Shahrah-e Faisal hums with the clatter of cash counters, the hiss of air-conditioners, and the low murmur of customers negotiating prices for fresh mangoes. Maryam, the branch’s senior operations officer, leans over her tablet, eyes darting between a customer’s smiling face and the flashing red icon that has just appeared on her screen. The bank’s fraud detection engine has just raised an alert on a 2.5 million PKR transfer destined for an offshore account. Her pulse quickens as the AI system begins to pulse with activity, pulling data from the legacy core, the mobile app, and the ATM network in a cascade of milliseconds. In that heartbeat, a decision will be made that could protect a family’s savings or expose a loophole that criminals might exploit.
Why it matters now is plain as the neon sign outside the branch. Pakistan’s digital payments have surged past 150 million transactions a year, a volume that would fill the Karachi port with physical cash if it were still moving on paper. Each transaction is a potential entry point for fraud, and each successful breach erodes trust in the financial system, discourages adoption, and invites regulatory scrutiny. At the same time, the country is racing to build a home-grown AI talent pool; the banks that master these tools will become the biggest employers of data scientists, model engineers, and compliance analysts in the region. In short, a robust fraud detection pipeline protects customers, fuels high-skill jobs, and bolsters the nation’s reputation as a safe place for digital money.
From raw data to alerts
The journey starts in the bank’s core system, a decades-old platform that still speaks in COBOL and batch files. A nightly extract pushes transaction logs, account balances, and customer profiles into a secure data lake. The first practical step for any institution is to automate this extract with a REST API that encrypts each payload, eliminating manual file drops that can be delayed or corrupted. Once the data lands in the lake, a stream processor rewrites it into a uniform schema, adding timestamps in UTC and tagging each record with a source identifier (core, mobile, ATM).
Real time feature engineering follows. Instead of waiting for a nightly batch, the system computes velocity metrics, how many transfers a customer has made in the past hour, the average amount, and the geographic spread of recipient accounts. A simple rule of thumb that many banks ignore is to include a “merchant similarity score”: compare the merchant code of the current transaction with the three most recent codes for the same customer. If the score drops below a threshold, the transaction is flagged for further scrutiny. This metric alone can catch fraudsters who jump between unrelated vendors to avoid detection.
Model training runs on a separate sandbox that mirrors the production environment. Engineers feed the engineered features into a gradient-boosted tree model that has been tuned on the last two years of known fraud cases. Because fraud patterns in Pakistan often involve rapid cross-border transfers followed by immediate cash-out, the model assigns higher weight to “destination country risk” and “time-of-day anomaly”. The bank updates the model every month, but also keeps a rolling window of the last 30 days to capture emerging schemes. A concrete idea for a data science team is to schedule an automated retraining pipeline using a cron job that pulls the latest labeled data, validates performance against a hold-out set, and publishes the new model only if the false-positive rate improves by at least two percentage points.
Scoring engines sit at the edge of the transaction flow. As a payment request arrives, the engine pulls the latest feature vector, runs it through the model, and returns a fraud probability. If the score exceeds 0.85, the request is paused and an alert is pushed to Maryam’s dashboard. The alert contains a concise summary: “High risk transfer to XYZ Bank, Philippines, 2.5 M PKR, velocity 5 transactions/hour, merchant similarity 0.12.” This brevity lets the analyst act within the narrow window before the funds move further.
Human in the loop
No AI system operates in isolation. Maryam receives the alert, reviews the transaction details, and decides whether to approve, reject, or escalate. The bank equips her with a “decision aid” that lists precedent cases with similar patterns and the outcomes of past analyst actions. A practical tip for any fraud operations team is to maintain a shared knowledge base where analysts log the reasoning behind each decision; this repository becomes a valuable source of labeled data for future model refinements.
When Maryam clicks “Reject”, the system automatically generates a compliance report that logs the transaction ID, the model score, and her rationale. This report satisfies the State Bank of Pakistan’s requirement for audit trails and feeds back into the model’s training set, closing the feedback loop. Over time, the false-positive rate drops, and the bank can lower the threshold without compromising security, freeing up capital that would otherwise sit idle in hold accounts.
A concrete outcome of this pipeline is visible in the story of Ali, a small textile shop owner in Gulshan-e Iqbal. Last month, Ali attempted to
About the author
Editor, FintechBulletins. Muzammil reports on Pakistan's financial technology sector — wallets, open banking, lending and the people building them. Follow on LinkedIn.